How could I detect someone running a Tor bridge inside my local network? I guess I could use a Tor client and try all the IPs to see if they work as a bridge. Is there a faster solution? Maybe using nmap somehow? I am a normal user inside the network, so I don't control any switch, etc.
2 Answers
Try wireshark/tcpdump, the dumps can be sorted for encrypted packets. Then just look for patterns.
Why are you looking for a bridge if you are not the admin?
-
I would hazard a guess of 'so he can have concrete evidence when he goes to the admins'. It's like having photos when you go to the police; they're more likely to listen and follow up if you can do half their work for them. Dec 7, 2011 at 1:36
-
No, it's nothing involving police :) It's more like an experiment. Anyway, I am capturing traffic with wireshark but most of the TCP traffic appears encrypted. Every packet is around 60 bytes and looks encrypted or garbage, though I don't see a lot of TLS handshakes going on. Any idea how this is done? I haven't done anything special when setting up the connection. It uses DHCP. Dec 8, 2011 at 16:36
-
I can't say exactly what to look for. You might try setting up your own tor bridge and look for similarities, esp with the handshaking– NovemberDec 10, 2011 at 0:43
A bridge is a way for external Internet users to access the Tor network. You could focus the testing to the external accessible IPs of your network. A lot of research remains on how to hide bridges better and experiments is good. Learn more about bridges here https://trac.torproject.org/projects/tor/search?q=bridge
-
-
nmap scanning 7000 IPs as a normal user on the network is not advisable and will likely get you in trouble. Dec 11, 2011 at 8:32